From d30b4403ea5e276cedd574e071fcd39007404afc Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 11:35:58 -0400
Subject: [PATCH 1/7] Reintroduce a Dependabot configuration file.

---
 .github/dependabot.yml | 213 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 213 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000000..24e2573546f53
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,213 @@
+# Configure Dependabot scanning.
+version: 2
+
+updates:
+  # Check for updates to GitHub Actions.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Check for updates to Composer packages.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    ignore:
+      # These dependencies do not currently need to be managed with Dependabot.
+      - dependency-name: "squizlabs/php_codesniffer"
+      - dependency-name: "wp-coding-standards/wpcs"
+      - dependency-name: "phpcompatibility/php-compatibility"
+      - dependency-name: "yoast/phpunit-polyfills"
+    groups:
+      composer-packages:
+        patterns:
+          - "composer/ca-bundle"
+
+  # Monitor some npm dependencies for updates in groups.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 20
+    ignore:
+      - dependency-name: "@wordpress/*"
+    groups:
+      ##
+      # Groups for updating devDependencies.
+      ##
+
+      # Dependencies related to Playwright testing (E2E, performance).
+      tests-playwright:
+        patterns:
+          - "*playwright*"
+      # Dependencies related to JavaScript testing with QUnit.
+      tests-qunit:
+        patterns:
+          - "*qunit*"
+          - "sinon*"
+      # Dependencies related to CSS and SASS building and manilupating.
+      dev-css-sass:
+        patterns:
+          - "autoprefixer"
+          # postcss and css related dependencies.
+          - "*css*"
+          - "*sass"
+      # Dependencies related to the Webpack build process.
+      dev-webpack:
+        patterns:
+          - "*webpack*"
+          - "react-refresh"
+          - "source-map-loader"
+      # Dependencies related to the local Docker development environment.
+      dev-docker:
+        patterns:
+          - "dotenv*"
+          - "wait-on"
+      # Dependencies that do not fall into a specific grouping.
+      dev-miscellaneous:
+        patterns:
+          - "chalk"
+          - "check-node-version"
+          - "ink-docstrap"
+          - "install-changed"
+          - "matchdep"
+          - "uuid"
+      # Dependencies related to JavaScript minification.
+      dev-uglify:
+        patterns:
+          - "*uglify*"
+      # All GruntJS related dependencies that do not relate to another group.
+      dev-grunt:
+        patterns:
+          - "*grunt*"
+
+      ##
+      # Groups for updating production dependencies.
+      ##
+
+      # Dependencies related to jQuery and its ecosystem.
+      external-jquery:
+        patterns:
+          - "jquery*"
+      # Dependencies related to React and its ecosystem.
+      external-react:
+        patterns:
+          - "react*"
+          - "!react-refresh"
+      # Dependencies used for bundling polyfill libraries into WordPress.
+      external-polyfills:
+        patterns:
+          - "core-js-url-browser"
+          - "element-closest"
+          - "formdata-polyfill"
+          - "imagesloaded"
+          - "objectFitPolyfill"
+          - "polyfill-library"
+          - "regenerator-runtime"
+          - "whatwg-fetch"
+          - "wicg-inert"
+      # Dependencies related to the Masonry library.
+      external-masonry:
+        patterns:
+          - "masonry-layout"
+      # Dependencies that do not fall into a specific grouping.
+      external-miscellaneous:
+        patterns:
+          - "backbone"
+          - "clipboard"
+          - "hoverintent"
+          - "json2php"
+          - "lodash"
+          - "moment"
+          - "underscore"
+
+  # Monitor npm dependencies within default themes.
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentyfive"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentyfive-css:
+        patterns:
+          - "**browserslist*"
+          - "*css*"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentytwo"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentytwo-css:
+        patterns:
+          - "**browserslist*"
+          - "*css*"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwentyone"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwentyone-sass-css:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+          - "*sass*"
+          - "!*stylelint*"
+      twentytwentyone-eslint:
+        patterns:
+          - "**eslint*"
+      twentytwentyone-stylelint:
+        patterns:
+          - "**stylelint*"
+      twentytwentyone-miscellaneous:
+        patterns:
+          - "chokidar-cli"
+          - "minimist"
+          - "npm-run-all"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentytwenty"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentytwenty-css:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+      twentytwenty-stylelint:
+        patterns:
+          - "*stylelint*"
+      twentytwenty-miscellaneous:
+        patterns:
+          - "concurrently"
+          - "@wordpress/scripts"
+
+  - package-ecosystem: "npm"
+    directory: "/src/wp-content/themes/twentynineteen"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    groups:
+      twentynineteen-css-sass:
+        patterns:
+          - "**browserslist*"
+          - "autoprefixer"
+          - "*css*"
+          - "*sass*"
+      twentynineteen-miscellaneous:
+        patterns:
+          - "chokidar-cli"
+          - "npm-run-all"

From 79be852aa4fcbd715f86877d666cc76d8bd54dd5 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 11:41:49 -0400
Subject: [PATCH 2/7] Add a workflow to create backport PRs.

---
 .github/workflows/backport.yml | 369 +++++++++++++++++++++++++++++++++
 1 file changed, 369 insertions(+)
 create mode 100644 .github/workflows/backport.yml

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
new file mode 100644
index 0000000000000..a6091199be590
--- /dev/null
+++ b/.github/workflows/backport.yml
@@ -0,0 +1,369 @@
+name: Create backport pull requests
+
+on:
+  workflow_dispatch:
+    inputs:
+      end_branch:
+        description: 'The branch to end at (e.g. 6.9). Defaults to the current supported branch.'
+        required: false
+        type: string
+        default: '7.0'
+      pr-name:
+        description: 'Pull request name (format is "<pr-name> - <branch> branch".'
+        required: false
+        type: string
+        default: ''
+      commit-sha:
+        description: 'Full length commit hash to stage for backport.'
+        required: false
+        type: string
+        default: ''
+      pr_numbers:
+        description: 'Comma-separated PR numbers. Ignored when a SHA is provided.'
+        required: false
+        type: string
+        default: ''
+      repo-source:
+        description: 'Repository to merge changes from.'
+        required: false
+        type: choice
+        default: 'upstream'
+        options:
+          - upstream
+          - current
+      pr-target:
+        description: 'Repository to submit pull requests to.'
+        required: false
+        type: choice
+        default: 'current'
+        options:
+          - upstream
+          - current
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  validate-inputs:
+    name: Validate inputs
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Ensure a commit SHA or PR numbers are provided
+        env:
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -z "${INPUTS_COMMIT_SHA}" ] && [ -z "${INPUTS_PR_NUMBERS}" ]; then
+            echo "::error::A commit SHA or PR number(s) must be included."
+            exit 1
+          fi
+
+  get-branches:
+    name: Get target branches
+    needs: [ 'validate-inputs' ]
+    runs-on: ubuntu-24.04
+    outputs:
+      branches: ${{ steps.branches.outputs.result }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      # Read keys from .version-support-php.json, filter to those >= end_branch,
+      # convert dashes to dots, and sort numerically descending.
+      # The first key is always the version in active development on trunk, so skip it.
+      - name: Get target branches
+        id: branches
+        env:
+          INPUTS_END_BRANCH: ${{ inputs.end_branch }}
+        run: |
+          END_X=$(echo "${INPUTS_END_BRANCH}" | cut -d. -f1)
+          END_Y=$(echo "${INPUTS_END_BRANCH}" | cut -d. -f2)
+
+          BRANCHES=$(jq -c \
+            --argjson x "$END_X" \
+            --argjson y "$END_Y" \
+            '[ keys[] |
+                . as $k | ($k | split("-")) as $p |
+                select( ($p[0]|tonumber) > $x or
+                        (($p[0]|tonumber) == $x and ($p[1]|tonumber) >= $y) ) |
+                { v: ($k | gsub("-"; ".")), x: ($p[0]|tonumber), y: ($p[1]|tonumber) }
+             ] | sort_by(.x, .y) | reverse | .[1:] | map(.v)' \
+            .version-support-php.json)
+
+          echo "result=$BRANCHES" >> "$GITHUB_OUTPUT"
+
+  backport:
+    name: 'Backport to ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches' ]
+    if: ${{ needs.get-branches.outputs.branches != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: 'true'
+
+      - name: Set up git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Add upstream remote
+        id: upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          UPSTREAM=$(gh repo view "${{ github.repository }}" --json parent --jq 'if .parent then "\(.parent.owner.login)/\(.parent.name)" else empty end')
+          if [ -n "$UPSTREAM" ]; then
+            git remote add upstream "https://github.com/${UPSTREAM}.git"
+            git fetch upstream
+            echo "repo=$UPSTREAM" >> "$GITHUB_OUTPUT"
+          else
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Determine the name of the branch for the pull request.
+      #
+      # 1. pr-name (normalized to alphanumeric, hyphens, and periods only)
+      # 2. commit-sha
+      # 3. pr_numbers with commas replaced by hyphens
+      - name: Determine backport branch name
+        id: backport-branch
+        env:
+          INPUTS_PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${INPUTS_PR_NAME}" ]; then
+            echo "name=backport/${MATRIX_BRANCH}-$(echo "${INPUTS_PR_NAME}" | tr -cs '[:alnum:].-' '-' | sed 's/^-//;s/-$//')" >> "$GITHUB_OUTPUT"
+          elif [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            echo "name=backport/${MATRIX_BRANCH}-${INPUTS_COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=backport/${MATRIX_BRANCH}-$(echo "${INPUTS_PR_NUMBERS}" | tr -d ' ' | tr ',' '-')" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create backport branch
+        env:
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+        run: |
+          if git ls-remote --exit-code --heads origin "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}" > /dev/null 2>&1; then
+            echo "::error::Branch '${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}' already exists on origin."
+            exit 1
+          fi
+
+          git checkout -b "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}" "origin/${MATRIX_BRANCH}"
+
+      - name: Cherry-pick commit
+        if: ${{ inputs['commit-sha'] != '' }}
+        env:
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+        run: |
+          COMMIT="${INPUTS_COMMIT_SHA}"
+          PARENTS=$(git cat-file -p "$COMMIT" | grep -c '^parent ' || true)
+
+          if [ "$PARENTS" -gt 1 ]; then
+            git cherry-pick -m 1 "$COMMIT"
+          else
+            git cherry-pick "$COMMIT"
+          fi
+
+      - name: Merge PRs
+        id: merge-prs
+        if: ${{ inputs['commit-sha'] == '' && inputs.pr_numbers != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_UPSTREAM_OUTPUTS_REPO: ${{ steps.upstream.outputs.repo }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          INPUTS_REPO_SOURCE: ${{ inputs.repo-source }}
+        run: |
+          if [ "${INPUTS_REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+
+          UPSTREAM_URL="https://github.com/${STEPS_UPSTREAM_OUTPUTS_REPO}.git"
+          RESULTS=""
+          FAILED=false
+
+          for PR_NUMBER in "${PR_LIST[@]}"; do
+            PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$PR_REPO" --json title,mergeCommit,baseRefName)
+            PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+            MERGE_COMMIT=$(echo "$PR_DATA" | jq -r '.mergeCommit.oid')
+
+            set +e
+            if [ -n "$MERGE_COMMIT" ] && [ "$MERGE_COMMIT" != "null" ]; then
+              # PR is merged: cherry-pick its merge commit.
+              # Determine if it is a merge commit or squash commit.
+              PARENTS=$(git cat-file -p "$MERGE_COMMIT" | grep -c '^parent ' || true)
+
+              if [ "$PARENTS" -gt 1 ]; then
+                git cherry-pick -m 1 --no-commit "$MERGE_COMMIT"
+              else
+                git cherry-pick --no-commit "$MERGE_COMMIT"
+              fi
+            else
+              # PR is open or closed without merging: apply its changes as a diff
+              # against the point where it diverged from its base branch.
+              BASE_REF=$(echo "$PR_DATA" | jq -r '.baseRefName')
+
+              git fetch "$UPSTREAM_URL" "$BASE_REF"
+              BASE_SHA=$(git rev-parse FETCH_HEAD)
+
+              git fetch "$UPSTREAM_URL" "refs/pull/${PR_NUMBER}/head"
+              PR_HEAD_SHA=$(git rev-parse FETCH_HEAD)
+
+              MERGE_BASE=$(git merge-base "$PR_HEAD_SHA" "$BASE_SHA")
+              git diff "$MERGE_BASE" "$PR_HEAD_SHA" | git apply --index
+            fi
+            APPLY_EXIT=$?
+            set -e
+
+            if [ $APPLY_EXIT -eq 0 ]; then
+              git commit -m "$PR_TITLE"
+              RESULTS="${RESULTS}${PR_NUMBER}=✅ "
+            else
+              git cherry-pick --abort 2>/dev/null || git reset --hard HEAD
+              RESULTS="${RESULTS}${PR_NUMBER}=❌ "
+              FAILED=true
+              break
+            fi
+          done
+
+          echo "results=${RESULTS}" >> "$GITHUB_OUTPUT"
+
+          if [ "$FAILED" = "true" ]; then
+            exit 1
+          fi
+
+      - name: Push backport branch
+        env:
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+        run: git push -u origin "${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+
+      - name: Create pull request
+        id: create-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_UPSTREAM_OUTPUTS_REPO: ${{ steps.upstream.outputs.repo }}
+          INPUTS_PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          INPUTS_REPO_SOURCE: ${{ inputs.repo-source }}
+          INPUTS_PR_TARGET: ${{ inputs.pr-target }}
+          STEPS_BACKPORT_BRANCH_OUTPUTS_NAME: ${{ steps.backport-branch.outputs.name }}
+        run: |
+          if [ "${INPUTS_REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          if [ -n "${INPUTS_PR_NAME}" ]; then
+            PR_TITLE="${INPUTS_PR_NAME} - ${MATRIX_BRANCH} branch"
+          else
+            PR_TITLE="Backport to ${MATRIX_BRANCH}"
+          fi
+
+          if [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            BODY="This pull request backports \`${INPUTS_COMMIT_SHA}\` (https://github.com/${STEPS_UPSTREAM_OUTPUTS_REPO}/commit/${INPUTS_COMMIT_SHA}) to the \`${MATRIX_BRANCH}\` branch."
+          else
+            BODY="Backports to the \`${MATRIX_BRANCH}\` branch."
+          fi
+
+          BODY="${BODY}\n\n## Changes Included\n"
+
+          if [ -n "${INPUTS_COMMIT_SHA}" ]; then
+            COMMIT_MESSAGE=$(git log --format=%B -n 1 "${INPUTS_COMMIT_SHA}")
+            BLOCKQUOTE=$(echo "${COMMIT_MESSAGE}" | sed 's/^/> /')
+            BODY="${BODY}\n${BLOCKQUOTE}"
+          fi
+
+          if [ -n "${INPUTS_PR_NUMBERS}" ] && [ -z "${INPUTS_COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+            for PR_NUMBER in "${PR_LIST[@]}"; do
+              PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+              BODY="${BODY}\n- ${PR_REPO}#${PR_NUMBER}"
+            done
+          fi
+
+          if [ "${INPUTS_PR_TARGET}" = "upstream" ]; then
+            PR_REPO="${STEPS_UPSTREAM_OUTPUTS_REPO}"
+            PR_HEAD="${GITHUB_REPOSITORY_OWNER}:${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+            PR_HEAD="${STEPS_BACKPORT_BRANCH_OUTPUTS_NAME}"
+          fi
+
+          PR_URL=$(gh pr create \
+            --repo "${PR_REPO}" \
+            --base "${MATRIX_BRANCH}" \
+            --head "${PR_HEAD}" \
+            --title "$PR_TITLE" \
+            --assignee "${GITHUB_ACTOR}" \
+            --draft \
+            --body "$(echo -e "$BODY")")
+
+          if gh label list --repo "${PR_REPO}" --json name --jq '[.[].name] | contains(["Auto-backport"])' | grep -q 'true'; then
+            gh pr edit "$PR_URL" --repo "${PR_REPO}" --add-label 'Auto-backport'
+          else
+            echo "::notice::The 'Auto-backport' label does not exist on ${PR_REPO}. Consider adding it so that backport pull requests can be identified easily."
+          fi
+
+          echo "url=${PR_URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Write job summary
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          INPUTS_COMMIT_SHA: ${{ inputs.commit-sha }}
+          INPUTS_PR_NUMBERS: ${{ inputs.pr_numbers }}
+          STEPS_MERGE_PRS_OUTPUTS_RESULTS: ${{ steps.merge-prs.outputs.results }}
+          STEPS_CREATE_PR_OUTPUTS_URL: ${{ steps.create-pr.outputs.url }}
+        run: |
+          PR_DISPLAY="${STEPS_CREATE_PR_OUTPUTS_URL:-N/A}"
+
+          if [ -n "${INPUTS_PR_NUMBERS}" ] && [ -z "${INPUTS_COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${INPUTS_PR_NUMBERS}"
+
+            HEADER="| Branch |"
+            SEPARATOR="| :--- |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              HEADER="${HEADER} #${PR_NUM} |"
+              SEPARATOR="${SEPARATOR} :---: |"
+            done
+            HEADER="${HEADER} Pull Request |"
+            SEPARATOR="${SEPARATOR} :--- |"
+
+            ROW="| \`${MATRIX_BRANCH}\` |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              STATUS=$(echo "${STEPS_MERGE_PRS_OUTPUTS_RESULTS}" | tr ' ' '\n' | grep "^${PR_NUM}=" | cut -d= -f2)
+              ROW="${ROW} ${STATUS:-❌} |"
+            done
+            ROW="${ROW} ${PR_DISPLAY} |"
+
+            printf '%s\n%s\n%s\n' "$HEADER" "$SEPARATOR" "$ROW" >> "$GITHUB_STEP_SUMMARY"
+          else
+            printf '| Branch | Pull Request |\n| :--- | :--- |\n| `%s` | %s |\n' \
+              "${MATRIX_BRANCH}" "${PR_DISPLAY}" >> "$GITHUB_STEP_SUMMARY"
+          fi

From 96a9ec02835a4f5c4618929a058cfe22fe872ca1 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Fri, 17 Apr 2026 13:32:23 -0400
Subject: [PATCH 3/7] Add workflow for testing backport PRs.

---
 .github/workflows/create-backport-prs.yml | 532 ++++++++++++++++++++++
 1 file changed, 532 insertions(+)
 create mode 100644 .github/workflows/create-backport-prs.yml

diff --git a/.github/workflows/create-backport-prs.yml b/.github/workflows/create-backport-prs.yml
new file mode 100644
index 0000000000000..f0ad03ecc9636
--- /dev/null
+++ b/.github/workflows/create-backport-prs.yml
@@ -0,0 +1,532 @@
+name: Create backport pull requests
+
+on:
+  workflow_dispatch:
+    inputs:
+      end_branch:
+        description: 'The branch to end at (e.g. 6.9). Defaults to the current supported branch.'
+        required: false
+        type: string
+        default: '7.0'
+      pr-name:
+        description: 'Pull request name (format is "<pr-name> - <branch> branch".'
+        required: false
+        type: string
+        default: ''
+      commit-sha:
+        description: 'Full length commit hash to stage for backport.'
+        required: false
+        type: string
+        default: ''
+      pr_numbers:
+        description: 'Comma-separated PR numbers. Ignored when a SHA is provided.'
+        required: false
+        type: string
+        default: ''
+      repo-source:
+        description: 'Repository to merge changes from.'
+        required: false
+        type: choice
+        default: 'upstream'
+        options:
+          - upstream
+          - current
+      pr-target:
+        description: 'Repository to submit pull requests to.'
+        required: false
+        type: choice
+        default: 'current'
+        options:
+          - upstream
+          - current
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  # Confirms that enough information is included to attempt a backport.
+  validate-inputs:
+    name: Validate inputs
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Ensure a commit SHA or PR numbers are provided
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -z "${COMMIT_SHA}" ] && [ -z "${PR_NUMBERS}" ]; then
+            echo "::error::A commit SHA or PR number(s) must be included."
+            exit 1
+          fi
+
+  # Generates a list of branches to create backport PRs for.
+  #
+  # The keys are read from .version-support-php.json, filtered to only include
+  # any after the specified end branch, and sort numerically descending.
+  #
+  # The first key in the file is always skipped because it represents the next
+  # version of WordPress in active development in trunk.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Reads branch versions from .version-support-php.json and outputs a filtered, sorted list.
+  get-branches:
+    name: Get target branches
+    needs: [ 'validate-inputs' ]
+    runs-on: ubuntu-24.04
+    outputs:
+      branches: ${{ steps.branches.outputs.result }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Get target branches
+        id: branches
+        env:
+          END_BRANCH: ${{ inputs.end_branch }}
+        run: |
+          END_X=$(echo "${END_BRANCH}" | cut -d. -f1)
+          END_Y=$(echo "${END_BRANCH}" | cut -d. -f2)
+
+          BRANCHES=$(jq -c \
+            --argjson x "$END_X" \
+            --argjson y "$END_Y" \
+            '[ keys[] |
+                . as $k | ($k | split("-")) as $p |
+                select( ($p[0]|tonumber) > $x or
+                        (($p[0]|tonumber) == $x and ($p[1]|tonumber) >= $y) ) |
+                { v: ($k | gsub("-"; ".")), x: ($p[0]|tonumber), y: ($p[1]|tonumber) }
+             ] | sort_by(.x, .y) | reverse | .[1:] | map(.v)' \
+            .version-support-php.json)
+
+          echo "result=$BRANCHES" >> "$GITHUB_OUTPUT"
+
+  # Resolves shared context and variables used by all matrix jobs.
+  #
+  # The branch name suffix is determined in the following order:
+  # 1. pr-name (normalized to alphanumeric, hyphens, and periods only)
+  # 2. commit-sha
+  # 3. pr_numbers with commas replaced by hyphens
+  #
+  # Performs the following steps:
+  # - Determines whether the repository is a fork.
+  # - Constructs the branch name suffix.
+  resolve-context:
+    name: Resolve context
+    needs: [ 'validate-inputs', 'get-branches' ]
+    if: ${{ needs.get-branches.outputs.branches != '[]' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      upstream-repo: ${{ steps.upstream.outputs.repo }}
+      branch-suffix: ${{ steps.branch-suffix.outputs.value }}
+    steps:
+      - name: Detect upstream repository
+        id: upstream
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          UPSTREAM=$(gh repo view "${{ github.repository }}" --json parent --jq 'if .parent then "\(.parent.owner.login)/\(.parent.name)" else empty end')
+          if [ -n "$UPSTREAM" ]; then
+            echo "This repository is a fork of ${UPSTREAM}. Original repository configured as \`upstream\` remote."
+            echo "repo=$UPSTREAM" >> "$GITHUB_OUTPUT"
+          else
+            echo "This repository is not a fork. No \`upstream\` remote configured."
+            echo "repo=${{ github.repository }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Determine branch name suffix
+        id: branch-suffix
+        env:
+          PR_NAME: ${{ inputs.pr-name }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${PR_NAME}" ]; then
+            echo "value=$(echo "${PR_NAME}" | tr -cs '[:alnum:].-' '-' | sed 's/^-//;s/-$//')" >> "$GITHUB_OUTPUT"
+          elif [ -n "${COMMIT_SHA}" ]; then
+            echo "value=${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=$(echo "${PR_NUMBERS}" | tr -d ' ' | tr ',' '-')" >> "$GITHUB_OUTPUT"
+          fi
+
+  # Attempts to backport the specified changes in the desired branches.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Configures the Git author.
+  # - Configures the upstream remote (forks only).
+  # - Creates a new branch.
+  # - Performs a `git cherry-pick` when a SHA value is specified.
+  # - Attempts to merge changes from the pull requests specified.
+  # - Pushes the new branch to the origin remote.
+  backport:
+    name: 'Backport to ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches', 'resolve-context' ]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: 'true'
+
+      - name: Configure git user name and email
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Add upstream remote
+        env:
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+        run: |
+          if [ "${UPSTREAM_REPO}" != "${{ github.repository }}" ]; then
+            git remote add upstream "https://github.com/${UPSTREAM_REPO}.git"
+            git fetch upstream
+          fi
+
+      - name: Create backport branch
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+        run: |
+          BRANCH_NAME="backport-${MATRIX_BRANCH}/${HEAD_BRANCH_SUFFIX}"
+
+          if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" > /dev/null 2>&1; then
+            echo "::error::Branch '${BRANCH_NAME}' already exists on origin."
+            exit 1
+          fi
+
+          git checkout -b "${BRANCH_NAME}" "origin/${MATRIX_BRANCH}"
+
+      - name: Cherry-pick commit
+        if: ${{ inputs['commit-sha'] != '' }}
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+        run: |
+          COMMIT="${COMMIT_SHA}"
+          PARENTS=$(git cat-file -p "$COMMIT" | grep -c '^parent ' || true)
+
+          if [ "$PARENTS" -gt 1 ]; then
+            git cherry-pick -m 1 "$COMMIT"
+          else
+            git cherry-pick "$COMMIT"
+          fi
+
+      - name: Merge PRs
+        id: merge-prs
+        if: ${{ inputs['commit-sha'] == '' && inputs.pr_numbers != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+          REPO_SOURCE: ${{ inputs.repo-source }}
+        run: |
+          if [ "${REPO_SOURCE}" = "upstream" ]; then
+            PR_REPO="${UPSTREAM_REPO}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+
+          UPSTREAM_URL="https://github.com/${UPSTREAM_REPO}.git"
+          RESULTS=""
+          FAILED=false
+
+          for PR_NUMBER in "${PR_LIST[@]}"; do
+            PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo "$PR_REPO" --json title,mergeCommit,baseRefName)
+            PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+            MERGE_COMMIT=$(echo "$PR_DATA" | jq -r '.mergeCommit.oid')
+
+            set +e
+            if [ -n "$MERGE_COMMIT" ] && [ "$MERGE_COMMIT" != "null" ]; then
+              # PR is merged: cherry-pick its merge commit.
+              # Determine if it is a merge commit or squash commit.
+              PARENTS=$(git cat-file -p "$MERGE_COMMIT" | grep -c '^parent ' || true)
+
+              if [ "$PARENTS" -gt 1 ]; then
+                git cherry-pick -m 1 --no-commit "$MERGE_COMMIT"
+              else
+                git cherry-pick --no-commit "$MERGE_COMMIT"
+              fi
+            else
+              # PR is open or closed without merging: apply its changes as a diff
+              # against the point where it diverged from its base branch.
+              BASE_REF=$(echo "$PR_DATA" | jq -r '.baseRefName')
+
+              git fetch "$UPSTREAM_URL" "$BASE_REF"
+              BASE_SHA=$(git rev-parse FETCH_HEAD)
+
+              git fetch "$UPSTREAM_URL" "refs/pull/${PR_NUMBER}/head"
+              PR_HEAD_SHA=$(git rev-parse FETCH_HEAD)
+
+              MERGE_BASE=$(git merge-base "$PR_HEAD_SHA" "$BASE_SHA")
+              git diff "$MERGE_BASE" "$PR_HEAD_SHA" | git apply --index
+            fi
+            APPLY_EXIT=$?
+            set -e
+
+            if [ $APPLY_EXIT -eq 0 ]; then
+              git commit -m "$PR_TITLE"
+              RESULTS="${RESULTS}${PR_NUMBER}=✅ "
+            else
+              git cherry-pick --abort 2>/dev/null || git reset --hard HEAD
+              RESULTS="${RESULTS}${PR_NUMBER}=❌ "
+              FAILED=true
+            fi
+          done
+
+          echo "results=${RESULTS}" >> "$GITHUB_OUTPUT"
+
+          if [ "$FAILED" = "true" ]; then
+            exit 1
+          fi
+
+      - name: Push backport branch
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+        run: git push -u origin "backport-${MATRIX_BRANCH}/${HEAD_BRANCH_SUFFIX}"
+
+      - name: Save results
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          MERGE_RESULTS: ${{ steps.merge-prs.outputs.results }}
+        run: |
+          mkdir -p apply-results
+          SAFE_BRANCH=$(echo "${MATRIX_BRANCH}" | tr '.' '-')
+          {
+            echo "branch=${MATRIX_BRANCH}"
+            echo "merge_results=${MERGE_RESULTS}"
+          } > "apply-results/${SAFE_BRANCH}.txt"
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: apply-results-${{ matrix.branch }}
+          path: apply-results/
+          retention-days: 1
+
+  # Creates a draft pull request for each successfully applied backport branch.
+  # Requires only write access to pull requests, keeping git operations separate.
+  #
+  # Performs the following steps:
+  # - Downloads the apply result artifact to confirm changes were applied successfully.
+  # - Creates a draft pull request targeting the specified repository.
+  # - Adds the `Auto-backport` label to the pull request if it exists.
+  # - Formats and uploads a pre-rendered summary row artifact for the report job.
+  create-pr:
+    name: 'Create PR for ${{ matrix.branch }}'
+    needs: [ 'validate-inputs', 'get-branches', 'resolve-context', 'backport' ]
+    if: ${{ always() && !cancelled() && needs.resolve-context.result == 'success' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJson( needs.get-branches.outputs.branches ) }}
+    steps:
+      - name: Download apply result
+        id: apply-result
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: apply-results-${{ matrix.branch }}
+          path: apply-result/
+        continue-on-error: true
+
+      - name: Create pull request
+        id: create-pr
+        if: ${{ steps.apply-result.outcome == 'success' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPSTREAM_REPO: ${{ needs.resolve-context.outputs.upstream-repo }}
+          HEAD_BRANCH_SUFFIX: ${{ needs.resolve-context.outputs.branch-suffix }}
+          PR_NAME: ${{ inputs.pr-name }}
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+          REPO_SOURCE: ${{ inputs.repo-source }}
+          PR_TARGET: ${{ inputs.pr-target }}
+        run: |
+          BACKPORT_BRANCH="backport-${MATRIX_BRANCH}/${HEAD_BRANCH_SUFFIX}"
+
+          if [ "${REPO_SOURCE}" = "upstream" ]; then
+            SOURCE_REPO="${UPSTREAM_REPO}"
+          else
+            SOURCE_REPO="${GITHUB_REPOSITORY}"
+          fi
+
+          if [ -n "${PR_NAME}" ]; then
+            PR_TITLE="${PR_NAME} - ${MATRIX_BRANCH} branch"
+          else
+            PR_TITLE="Backport to ${MATRIX_BRANCH}"
+          fi
+
+          if [ -n "${COMMIT_SHA}" ]; then
+            BODY="This pull request backports \`${COMMIT_SHA}\` (https://github.com/${UPSTREAM_REPO}/commit/${COMMIT_SHA}) to the \`${MATRIX_BRANCH}\` branch."
+          else
+            BODY="Backports to the \`${MATRIX_BRANCH}\` branch."
+          fi
+
+          BODY="${BODY}\n\n## Changes Included\n"
+
+          if [ -n "${COMMIT_SHA}" ]; then
+            COMMIT_MESSAGE=$(gh api "repos/${UPSTREAM_REPO}/commits/${COMMIT_SHA}" --jq '.commit.message')
+            BLOCKQUOTE=$(echo "${COMMIT_MESSAGE}" | sed 's/^/> /')
+            BODY="${BODY}\n${BLOCKQUOTE}"
+          fi
+
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+            for PR_NUMBER in "${PR_LIST[@]}"; do
+              PR_NUMBER=$(echo "$PR_NUMBER" | tr -d ' ')
+              BODY="${BODY}\n- ${SOURCE_REPO}#${PR_NUMBER}"
+            done
+          fi
+
+          BODY="${BODY}\n\n---\n\nThis PR was generated from a [GitHub Actions workflow run](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) triggered by @${GITHUB_ACTOR}."
+
+          if [ "${PR_TARGET}" = "upstream" ]; then
+            PR_REPO="${UPSTREAM_REPO}"
+            PR_HEAD="${GITHUB_REPOSITORY_OWNER}:${BACKPORT_BRANCH}"
+          else
+            PR_REPO="${GITHUB_REPOSITORY}"
+            PR_HEAD="${BACKPORT_BRANCH}"
+          fi
+
+          PR_URL=$(gh pr create \
+            --repo "${PR_REPO}" \
+            --base "${MATRIX_BRANCH}" \
+            --head "${PR_HEAD}" \
+            --title "$PR_TITLE" \
+            --assignee "${GITHUB_ACTOR}" \
+            --draft \
+            --body "$(echo -e "$BODY")")
+
+          if gh label list --repo "${PR_REPO}" --json name --jq '[.[].name] | contains(["Auto-backport"])' | grep -q 'true'; then
+            gh pr edit "$PR_URL" --repo "${PR_REPO}" --add-label 'Auto-backport'
+          else
+            echo "::notice::The 'Auto-backport' label does not exist on ${PR_REPO}. Consider adding it so that backport pull requests can be identified easily."
+          fi
+
+          echo "url=${PR_URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Save summary row
+        if: always()
+        env:
+          MATRIX_BRANCH: ${{ matrix.branch }}
+          PR_URL: ${{ steps.create-pr.outputs.url }}
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+          PR_NAME: ${{ inputs.pr-name }}
+        run: |
+          mkdir -p summary-row
+          SAFE_BRANCH=$(echo "${MATRIX_BRANCH}" | tr '.' '-')
+          MERGE_RESULTS=""
+
+          if [ -f "apply-result/${SAFE_BRANCH}.txt" ]; then
+            MERGE_RESULTS=$(grep '^merge_results=' "apply-result/${SAFE_BRANCH}.txt" | cut -d= -f2-)
+          fi
+
+          RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+
+          if [ -n "${PR_URL}" ]; then
+            if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+              PR_DISPLAY="${PR_URL}"
+            else
+              if [ -n "${PR_NAME}" ]; then
+                PR_TITLE="${PR_NAME} - ${MATRIX_BRANCH} branch"
+              else
+                PR_TITLE="Backport to ${MATRIX_BRANCH}"
+              fi
+              PR_DISPLAY="[${PR_TITLE}](${PR_URL})"
+            fi
+          else
+            PR_DISPLAY="[View log](${RUN_URL})"
+          fi
+
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+            ROW="| \`${MATRIX_BRANCH}\` |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              STATUS=$(echo "${MERGE_RESULTS}" | tr ' ' '\n' | grep "^${PR_NUM}=" | cut -d= -f2)
+              ROW="${ROW} ${STATUS:-❌} |"
+            done
+            ROW="${ROW} ${PR_DISPLAY} |"
+          else
+            ROW="| \`${MATRIX_BRANCH}\` | ${PR_DISPLAY} |"
+          fi
+
+          printf '%s\n' "$ROW" > "summary-row/${SAFE_BRANCH}.txt"
+
+      - name: Upload summary row
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: summary-row-${{ matrix.branch }}
+          path: summary-row/
+          retention-days: 1
+
+  # Aggregates results from all matrix jobs into a single workflow summary.
+  #
+  # Performs the following steps:
+  # - Downloads pre-rendered summary row artifacts from all create-pr jobs.
+  # - Writes the table header and appends all rows to the workflow summary.
+  report:
+    name: Backport report
+    needs: [ 'validate-inputs', 'backport', 'create-pr' ]
+    runs-on: ubuntu-24.04
+    if: ${{ always() && needs.validate-inputs.result != 'failure' }}
+    steps:
+      - name: Download summary rows
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: summary-row-*
+          path: summary-rows/
+          merge-multiple: true
+        continue-on-error: true
+
+      - name: Write summary
+        env:
+          COMMIT_SHA: ${{ inputs.commit-sha }}
+          PR_NUMBERS: ${{ inputs.pr_numbers }}
+        run: |
+          if [ -n "${PR_NUMBERS}" ] && [ -z "${COMMIT_SHA}" ]; then
+            IFS=',' read -ra PR_LIST <<< "${PR_NUMBERS}"
+
+            HEADER="| Branch |"
+            SEPARATOR="| :--- |"
+            for PR_NUM in "${PR_LIST[@]}"; do
+              PR_NUM=$(echo "$PR_NUM" | tr -d ' ')
+              HEADER="${HEADER} #${PR_NUM} |"
+              SEPARATOR="${SEPARATOR} :---: |"
+            done
+            HEADER="${HEADER} Pull Request |"
+            SEPARATOR="${SEPARATOR} :--- |"
+
+            printf '%s\n%s\n' "$HEADER" "$SEPARATOR" >> "$GITHUB_STEP_SUMMARY"
+          else
+            printf '| Branch | Pull Request |\n| :--- | :--- |\n' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          for ROW_FILE in $(ls summary-rows/*.txt 2>/dev/null | sort); do
+            cat "${ROW_FILE}" >> "$GITHUB_STEP_SUMMARY"
+          done

From 7eb09cf265f7b724dee5c56ce625c82fc7207ae3 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Mon, 18 May 2026 08:53:45 -0400
Subject: [PATCH 4/7] Exclude major versions from Dependabot PRs.

---
 .github/dependabot.yml | 119 +++++++++++++++++++++++++++++++++++++----
 1 file changed, 109 insertions(+), 10 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 24e2573546f53..9d7df639e6421 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,18 +7,20 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 50
     groups:
       github-actions:
-        patterns:
-          - "*"
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
 
   # Check for updates to Composer packages.
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "daily"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 50
     ignore:
       # These dependencies do not currently need to be managed with Dependabot.
       - dependency-name: "squizlabs/php_codesniffer"
@@ -35,7 +37,7 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     ignore:
       - dependency-name: "@wordpress/*"
     groups:
@@ -45,15 +47,27 @@ updates:
 
       # Dependencies related to Playwright testing (E2E, performance).
       tests-playwright:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*playwright*"
       # Dependencies related to JavaScript testing with QUnit.
       tests-qunit:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*qunit*"
           - "sinon*"
       # Dependencies related to CSS and SASS building and manilupating.
       dev-css-sass:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "autoprefixer"
           # postcss and css related dependencies.
@@ -61,17 +75,29 @@ updates:
           - "*sass"
       # Dependencies related to the Webpack build process.
       dev-webpack:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*webpack*"
           - "react-refresh"
           - "source-map-loader"
       # Dependencies related to the local Docker development environment.
       dev-docker:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "dotenv*"
           - "wait-on"
       # Dependencies that do not fall into a specific grouping.
       dev-miscellaneous:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "chalk"
           - "check-node-version"
@@ -81,10 +107,18 @@ updates:
           - "uuid"
       # Dependencies related to JavaScript minification.
       dev-uglify:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*uglify*"
       # All GruntJS related dependencies that do not relate to another group.
       dev-grunt:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*grunt*"
 
@@ -94,15 +128,27 @@ updates:
 
       # Dependencies related to jQuery and its ecosystem.
       external-jquery:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "jquery*"
       # Dependencies related to React and its ecosystem.
       external-react:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "react*"
           - "!react-refresh"
       # Dependencies used for bundling polyfill libraries into WordPress.
       external-polyfills:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "core-js-url-browser"
           - "element-closest"
@@ -115,10 +161,18 @@ updates:
           - "wicg-inert"
       # Dependencies related to the Masonry library.
       external-masonry:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "masonry-layout"
       # Dependencies that do not fall into a specific grouping.
       external-miscellaneous:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "backbone"
           - "clipboard"
@@ -133,9 +187,13 @@ updates:
     directory: "/src/wp-content/themes/twentytwentyfive"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     groups:
       twentytwentyfive-css:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**browserslist*"
           - "*css*"
@@ -144,9 +202,13 @@ updates:
     directory: "/src/wp-content/themes/twentytwentytwo"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     groups:
       twentytwentytwo-css:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**browserslist*"
           - "*css*"
@@ -155,9 +217,13 @@ updates:
     directory: "/src/wp-content/themes/twentytwentyone"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     groups:
       twentytwentyone-sass-css:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**browserslist*"
           - "autoprefixer"
@@ -165,12 +231,24 @@ updates:
           - "*sass*"
           - "!*stylelint*"
       twentytwentyone-eslint:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**eslint*"
       twentytwentyone-stylelint:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**stylelint*"
       twentytwentyone-miscellaneous:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "chokidar-cli"
           - "minimist"
@@ -180,17 +258,30 @@ updates:
     directory: "/src/wp-content/themes/twentytwenty"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     groups:
       twentytwenty-css:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**browserslist*"
           - "autoprefixer"
           - "*css*"
       twentytwenty-stylelint:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "*stylelint*"
       twentytwenty-miscellaneous:
+        applies-to: version-updates
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "concurrently"
           - "@wordpress/scripts"
@@ -199,15 +290,23 @@ updates:
     directory: "/src/wp-content/themes/twentynineteen"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 50
     groups:
       twentynineteen-css-sass:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "**browserslist*"
           - "autoprefixer"
           - "*css*"
           - "*sass*"
       twentynineteen-miscellaneous:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "chokidar-cli"
           - "npm-run-all"

From 0577f21251d101b47ad243e7aad4af73520e6f2e Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Wed, 20 May 2026 23:56:59 -0400
Subject: [PATCH 5/7] Configure  day  period in Dependabot.

---
 .github/dependabot.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9d7df639e6421..1fe1d8f46901a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,8 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         applies-to: version-updates
@@ -21,6 +23,8 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     ignore:
       # These dependencies do not currently need to be managed with Dependabot.
       - dependency-name: "squizlabs/php_codesniffer"
@@ -38,6 +42,8 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     ignore:
       - dependency-name: "@wordpress/*"
     groups:
@@ -188,6 +194,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       twentytwentyfive-css:
         applies-to: version-updates
@@ -203,6 +211,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       twentytwentytwo-css:
         applies-to: version-updates
@@ -218,6 +228,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       twentytwentyone-sass-css:
         applies-to: version-updates
@@ -259,6 +271,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       twentytwenty-css:
         applies-to: version-updates
@@ -291,6 +305,8 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     groups:
       twentynineteen-css-sass:
         applies-to: version-updates

From 52fe215445ef6253d3fc6b23fc485950d04e884e Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Thu, 21 May 2026 00:01:17 -0400
Subject: [PATCH 6/7] Update dependabot.yml file.

---
 .github/dependabot.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1fe1d8f46901a..8cdbc7440b705 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,6 +33,10 @@ updates:
       - dependency-name: "yoast/phpunit-polyfills"
     groups:
       composer-packages:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
         patterns:
           - "composer/ca-bundle"
 
@@ -291,7 +295,6 @@ updates:
         patterns:
           - "*stylelint*"
       twentytwenty-miscellaneous:
-        applies-to: version-updates
         applies-to: version-updates
         update-types:
           - minor

From 408000aa5dc20dec1b3ed8e4beb21fc1d55f59e1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 21 May 2026 04:22:50 +0000
Subject: [PATCH 7/7] Bump the twentytwentyone-sass-css group across 1
 directory with 4 updates

Bumps the twentytwentyone-sass-css group with 4 updates in the /src/wp-content/themes/twentytwentyone directory: [@wordpress/browserslist-config](https://github.com/WordPress/gutenberg/tree/HEAD/packages/browserslist-config), [autoprefixer](https://github.com/postcss/autoprefixer), [postcss](https://github.com/postcss/postcss) and [sass](https://github.com/sass/dart-sass).


Updates `@wordpress/browserslist-config` from 6.34.0 to 6.45.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/browserslist-config/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/browserslist-config@6.45.0/packages/browserslist-config)

Updates `autoprefixer` from 10.4.22 to 10.5.0
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/autoprefixer/compare/10.4.22...10.5.0)

Updates `postcss` from 8.5.6 to 8.5.14
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.14)

Updates `sass` from 1.83.0 to 1.99.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.83.0...1.99.0)

---
updated-dependencies:
- dependency-name: "@wordpress/browserslist-config"
  dependency-version: 6.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: twentytwentyone-sass-css
- dependency-name: autoprefixer
  dependency-version: 10.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: twentytwentyone-sass-css
- dependency-name: postcss
  dependency-version: 8.5.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: twentytwentyone-sass-css
- dependency-name: sass
  dependency-version: 1.99.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: twentytwentyone-sass-css
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .../themes/twentytwentyone/package-lock.json  | 194 ++++++++----------
 .../themes/twentytwentyone/package.json       |   8 +-
 2 files changed, 94 insertions(+), 108 deletions(-)

diff --git a/src/wp-content/themes/twentytwentyone/package-lock.json b/src/wp-content/themes/twentytwentyone/package-lock.json
index 3f412536967cc..9a54c5166462c 100644
--- a/src/wp-content/themes/twentytwentyone/package-lock.json
+++ b/src/wp-content/themes/twentytwentyone/package-lock.json
@@ -9,15 +9,15 @@
 			"version": "2.8.0",
 			"license": "GPL-2.0-or-later",
 			"devDependencies": {
-				"@wordpress/browserslist-config": "^6.34.0",
+				"@wordpress/browserslist-config": "^6.45.0",
 				"@wordpress/eslint-plugin": "^22.20.0",
 				"@wordpress/stylelint-config": "^21.30.0",
-				"autoprefixer": "^10.4.22",
+				"autoprefixer": "^10.5.0",
 				"chokidar-cli": "^3.0.0",
 				"eslint": "^8.57.1",
 				"minimist": "^1.2.8",
 				"npm-run-all": "^4.1.5",
-				"postcss": "^8.5.6",
+				"postcss": "^8.5.14",
 				"postcss-calc": "^10.1.1",
 				"postcss-cli": "^11.0.1",
 				"postcss-css-variables": "^0.19.0",
@@ -28,7 +28,7 @@
 				"postcss-merge-rules": "^7.0.7",
 				"postcss-nested": "^7.0.2",
 				"rtlcss": "^4.3.0",
-				"sass": "^1.83.0",
+				"sass": "^1.99.0",
 				"stylelint": "^14.16.1",
 				"stylelint-config-recommended-scss": "^16.0.2"
 			},
@@ -2924,9 +2924,9 @@
 			}
 		},
 		"node_modules/@wordpress/browserslist-config": {
-			"version": "6.34.0",
-			"resolved": "https://registry.npmjs.org/@wordpress/browserslist-config/-/browserslist-config-6.34.0.tgz",
-			"integrity": "sha512-pmcCkqG2jW+UUBSkX7rSZS33mcW6M0fKcJPD40TlK2cUZvECS5TDa2BC/b80PfIsT2kSw+Z9Wv+8eyX6I8HGjQ==",
+			"version": "6.45.0",
+			"resolved": "https://registry.npmjs.org/@wordpress/browserslist-config/-/browserslist-config-6.45.0.tgz",
+			"integrity": "sha512-iSRD/0bxD9PUHWssZN1zZa+xZ2E9FtpgNYKeceTPLKV3rd+rRPqI1h2a2iHboLzex80c1vaxe6eQ9kyZQfGtiA==",
 			"dev": true,
 			"license": "GPL-2.0-or-later",
 			"engines": {
@@ -3685,9 +3685,9 @@
 			}
 		},
 		"node_modules/autoprefixer": {
-			"version": "10.4.22",
-			"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.22.tgz",
-			"integrity": "sha512-ARe0v/t9gO28Bznv6GgqARmVqcWOV3mfgUPn9becPHMiD3o9BwlRgaeccZnwTpZ7Zwqrm+c1sUSsMxIzQzc8Xg==",
+			"version": "10.5.0",
+			"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
+			"integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
 			"dev": true,
 			"funding": [
 				{
@@ -3705,10 +3705,9 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"browserslist": "^4.27.0",
-				"caniuse-lite": "^1.0.30001754",
+				"browserslist": "^4.28.2",
+				"caniuse-lite": "^1.0.30001787",
 				"fraction.js": "^5.3.4",
-				"normalize-range": "^0.1.2",
 				"picocolors": "^1.1.1",
 				"postcss-value-parser": "^4.2.0"
 			},
@@ -3796,13 +3795,16 @@
 			"dev": true
 		},
 		"node_modules/baseline-browser-mapping": {
-			"version": "2.8.25",
-			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.25.tgz",
-			"integrity": "sha512-2NovHVesVF5TXefsGX1yzx1xgr7+m9JQenvz6FQY3qd+YXkKkYiv+vTCc7OriP9mcDZpTC5mAOYN4ocd29+erA==",
+			"version": "2.10.31",
+			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
+			"integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
 			"dev": true,
 			"license": "Apache-2.0",
 			"bin": {
-				"baseline-browser-mapping": "dist/cli.js"
+				"baseline-browser-mapping": "dist/cli.cjs"
+			},
+			"engines": {
+				"node": ">=6.0.0"
 			}
 		},
 		"node_modules/big-integer": {
@@ -3859,9 +3861,9 @@
 			}
 		},
 		"node_modules/browserslist": {
-			"version": "4.28.0",
-			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.0.tgz",
-			"integrity": "sha512-tbydkR/CxfMwelN0vwdP/pLkDwyAASZ+VfWm4EOwlB6SWhx1sYnWLqo8N5j0rAzPfzfRaxt0mM/4wPU/Su84RQ==",
+			"version": "4.28.2",
+			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
+			"integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
 			"dev": true,
 			"funding": [
 				{
@@ -3879,11 +3881,11 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"baseline-browser-mapping": "^2.8.25",
-				"caniuse-lite": "^1.0.30001754",
-				"electron-to-chromium": "^1.5.249",
-				"node-releases": "^2.0.27",
-				"update-browserslist-db": "^1.1.4"
+				"baseline-browser-mapping": "^2.10.12",
+				"caniuse-lite": "^1.0.30001782",
+				"electron-to-chromium": "^1.5.328",
+				"node-releases": "^2.0.36",
+				"update-browserslist-db": "^1.2.3"
 			},
 			"bin": {
 				"browserslist": "cli.js"
@@ -3981,9 +3983,9 @@
 			}
 		},
 		"node_modules/caniuse-lite": {
-			"version": "1.0.30001754",
-			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001754.tgz",
-			"integrity": "sha512-x6OeBXueoAceOmotzx3PO4Zpt4rzpeIFsSr6AAePTZxSkXiYDUmpypEl7e2+8NCd9bD7bXjqyef8CJYPC1jfxg==",
+			"version": "1.0.30001793",
+			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
+			"integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
 			"dev": true,
 			"funding": [
 				{
@@ -4406,9 +4408,9 @@
 			}
 		},
 		"node_modules/electron-to-chromium": {
-			"version": "1.5.249",
-			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.249.tgz",
-			"integrity": "sha512-5vcfL3BBe++qZ5kuFhD/p8WOM1N9m3nwvJPULJx+4xf2usSlZFJ0qoNYO2fOX4hi3ocuDcmDobtA+5SFr4OmBg==",
+			"version": "1.5.360",
+			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
+			"integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
 			"dev": true,
 			"license": "ISC"
 		},
@@ -5931,9 +5933,9 @@
 			}
 		},
 		"node_modules/immutable": {
-			"version": "5.0.3",
-			"resolved": "https://registry.npmjs.org/immutable/-/immutable-5.0.3.tgz",
-			"integrity": "sha512-P8IdPQHq3lA1xVeBRi5VPqUm5HDgKnx0Ru51wZz5mjxHr5n3RWhjIpOFU7ybkUxfB+5IToy+OLaHYDBIWsv+uw==",
+			"version": "5.1.5",
+			"resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
+			"integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
 			"dev": true,
 			"license": "MIT"
 		},
@@ -6971,9 +6973,9 @@
 			"optional": true
 		},
 		"node_modules/node-releases": {
-			"version": "2.0.27",
-			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-			"integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+			"version": "2.0.44",
+			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
+			"integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
 			"dev": true,
 			"license": "MIT"
 		},
@@ -7007,15 +7009,6 @@
 				"node": ">=0.10.0"
 			}
 		},
-		"node_modules/normalize-range": {
-			"version": "0.1.2",
-			"resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
-			"integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-			"dev": true,
-			"engines": {
-				"node": ">=0.10.0"
-			}
-		},
 		"node_modules/npm-run-all": {
 			"version": "4.1.5",
 			"resolved": "https://registry.npmjs.org/npm-run-all/-/npm-run-all-4.1.5.tgz",
@@ -8063,9 +8056,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.6",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-			"integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+			"version": "8.5.14",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
+			"integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
 			"dev": true,
 			"funding": [
 				{
@@ -9254,14 +9247,14 @@
 			}
 		},
 		"node_modules/sass": {
-			"version": "1.83.0",
-			"resolved": "https://registry.npmjs.org/sass/-/sass-1.83.0.tgz",
-			"integrity": "sha512-qsSxlayzoOjdvXMVLkzF84DJFc2HZEL/rFyGIKbbilYtAvlCxyuzUeff9LawTn4btVnLKg75Z8MMr1lxU1lfGw==",
+			"version": "1.99.0",
+			"resolved": "https://registry.npmjs.org/sass/-/sass-1.99.0.tgz",
+			"integrity": "sha512-kgW13M54DUB7IsIRM5LvJkNlpH+WhMpooUcaWGFARkF1Tc82v9mIWkCbCYf+MBvpIUBSeSOTilpZjEPr2VYE6Q==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"chokidar": "^4.0.0",
-				"immutable": "^5.0.2",
+				"immutable": "^5.1.5",
 				"source-map-js": ">=0.6.2 <2.0.0"
 			},
 			"bin": {
@@ -10467,9 +10460,9 @@
 			}
 		},
 		"node_modules/update-browserslist-db": {
-			"version": "1.1.4",
-			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz",
-			"integrity": "sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+			"integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
 			"dev": true,
 			"funding": [
 				{
@@ -12449,9 +12442,9 @@
 			}
 		},
 		"@wordpress/browserslist-config": {
-			"version": "6.34.0",
-			"resolved": "https://registry.npmjs.org/@wordpress/browserslist-config/-/browserslist-config-6.34.0.tgz",
-			"integrity": "sha512-pmcCkqG2jW+UUBSkX7rSZS33mcW6M0fKcJPD40TlK2cUZvECS5TDa2BC/b80PfIsT2kSw+Z9Wv+8eyX6I8HGjQ==",
+			"version": "6.45.0",
+			"resolved": "https://registry.npmjs.org/@wordpress/browserslist-config/-/browserslist-config-6.45.0.tgz",
+			"integrity": "sha512-iSRD/0bxD9PUHWssZN1zZa+xZ2E9FtpgNYKeceTPLKV3rd+rRPqI1h2a2iHboLzex80c1vaxe6eQ9kyZQfGtiA==",
 			"dev": true
 		},
 		"@wordpress/eslint-plugin": {
@@ -12980,15 +12973,14 @@
 			"dev": true
 		},
 		"autoprefixer": {
-			"version": "10.4.22",
-			"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.22.tgz",
-			"integrity": "sha512-ARe0v/t9gO28Bznv6GgqARmVqcWOV3mfgUPn9becPHMiD3o9BwlRgaeccZnwTpZ7Zwqrm+c1sUSsMxIzQzc8Xg==",
+			"version": "10.5.0",
+			"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
+			"integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
 			"dev": true,
 			"requires": {
-				"browserslist": "^4.27.0",
-				"caniuse-lite": "^1.0.30001754",
+				"browserslist": "^4.28.2",
+				"caniuse-lite": "^1.0.30001787",
 				"fraction.js": "^5.3.4",
-				"normalize-range": "^0.1.2",
 				"picocolors": "^1.1.1",
 				"postcss-value-parser": "^4.2.0"
 			}
@@ -13050,9 +13042,9 @@
 			"dev": true
 		},
 		"baseline-browser-mapping": {
-			"version": "2.8.25",
-			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.25.tgz",
-			"integrity": "sha512-2NovHVesVF5TXefsGX1yzx1xgr7+m9JQenvz6FQY3qd+YXkKkYiv+vTCc7OriP9mcDZpTC5mAOYN4ocd29+erA==",
+			"version": "2.10.31",
+			"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
+			"integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
 			"dev": true
 		},
 		"big-integer": {
@@ -13096,16 +13088,16 @@
 			}
 		},
 		"browserslist": {
-			"version": "4.28.0",
-			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.0.tgz",
-			"integrity": "sha512-tbydkR/CxfMwelN0vwdP/pLkDwyAASZ+VfWm4EOwlB6SWhx1sYnWLqo8N5j0rAzPfzfRaxt0mM/4wPU/Su84RQ==",
+			"version": "4.28.2",
+			"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
+			"integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
 			"dev": true,
 			"requires": {
-				"baseline-browser-mapping": "^2.8.25",
-				"caniuse-lite": "^1.0.30001754",
-				"electron-to-chromium": "^1.5.249",
-				"node-releases": "^2.0.27",
-				"update-browserslist-db": "^1.1.4"
+				"baseline-browser-mapping": "^2.10.12",
+				"caniuse-lite": "^1.0.30001782",
+				"electron-to-chromium": "^1.5.328",
+				"node-releases": "^2.0.36",
+				"update-browserslist-db": "^1.2.3"
 			}
 		},
 		"builtin-modules": {
@@ -13169,9 +13161,9 @@
 			}
 		},
 		"caniuse-lite": {
-			"version": "1.0.30001754",
-			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001754.tgz",
-			"integrity": "sha512-x6OeBXueoAceOmotzx3PO4Zpt4rzpeIFsSr6AAePTZxSkXiYDUmpypEl7e2+8NCd9bD7bXjqyef8CJYPC1jfxg==",
+			"version": "1.0.30001793",
+			"resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
+			"integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
 			"dev": true
 		},
 		"chalk": {
@@ -13458,9 +13450,9 @@
 			}
 		},
 		"electron-to-chromium": {
-			"version": "1.5.249",
-			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.249.tgz",
-			"integrity": "sha512-5vcfL3BBe++qZ5kuFhD/p8WOM1N9m3nwvJPULJx+4xf2usSlZFJ0qoNYO2fOX4hi3ocuDcmDobtA+5SFr4OmBg==",
+			"version": "1.5.360",
+			"resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.360.tgz",
+			"integrity": "sha512-GkcBt6YYAw9SxFWn+xVar4cLVGlXVuswwtRLBozi2zp0GjXs4ZnOrqV4zbXzg35n7w81hCkyJNYicgXlVHAmBA==",
 			"dev": true
 		},
 		"emoji-regex": {
@@ -14533,9 +14525,9 @@
 			"dev": true
 		},
 		"immutable": {
-			"version": "5.0.3",
-			"resolved": "https://registry.npmjs.org/immutable/-/immutable-5.0.3.tgz",
-			"integrity": "sha512-P8IdPQHq3lA1xVeBRi5VPqUm5HDgKnx0Ru51wZz5mjxHr5n3RWhjIpOFU7ybkUxfB+5IToy+OLaHYDBIWsv+uw==",
+			"version": "5.1.5",
+			"resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
+			"integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
 			"dev": true
 		},
 		"import-fresh": {
@@ -15291,9 +15283,9 @@
 			"optional": true
 		},
 		"node-releases": {
-			"version": "2.0.27",
-			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-			"integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+			"version": "2.0.44",
+			"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
+			"integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
 			"dev": true
 		},
 		"normalize-package-data": {
@@ -15322,12 +15314,6 @@
 			"integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
 			"dev": true
 		},
-		"normalize-range": {
-			"version": "0.1.2",
-			"resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
-			"integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-			"dev": true
-		},
 		"npm-run-all": {
 			"version": "4.1.5",
 			"resolved": "https://registry.npmjs.org/npm-run-all/-/npm-run-all-4.1.5.tgz",
@@ -16073,9 +16059,9 @@
 			"dev": true
 		},
 		"postcss": {
-			"version": "8.5.6",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-			"integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+			"version": "8.5.14",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
+			"integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
 			"dev": true,
 			"requires": {
 				"nanoid": "^3.3.11",
@@ -16834,14 +16820,14 @@
 			}
 		},
 		"sass": {
-			"version": "1.83.0",
-			"resolved": "https://registry.npmjs.org/sass/-/sass-1.83.0.tgz",
-			"integrity": "sha512-qsSxlayzoOjdvXMVLkzF84DJFc2HZEL/rFyGIKbbilYtAvlCxyuzUeff9LawTn4btVnLKg75Z8MMr1lxU1lfGw==",
+			"version": "1.99.0",
+			"resolved": "https://registry.npmjs.org/sass/-/sass-1.99.0.tgz",
+			"integrity": "sha512-kgW13M54DUB7IsIRM5LvJkNlpH+WhMpooUcaWGFARkF1Tc82v9mIWkCbCYf+MBvpIUBSeSOTilpZjEPr2VYE6Q==",
 			"dev": true,
 			"requires": {
 				"@parcel/watcher": "^2.4.1",
 				"chokidar": "^4.0.0",
-				"immutable": "^5.0.2",
+				"immutable": "^5.1.5",
 				"source-map-js": ">=0.6.2 <2.0.0"
 			},
 			"dependencies": {
@@ -17703,9 +17689,9 @@
 			"dev": true
 		},
 		"update-browserslist-db": {
-			"version": "1.1.4",
-			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz",
-			"integrity": "sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+			"integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
 			"dev": true,
 			"requires": {
 				"escalade": "^3.2.0",
diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json
index 2e84df4ffb3b4..aa9db29f95dff 100644
--- a/src/wp-content/themes/twentytwentyone/package.json
+++ b/src/wp-content/themes/twentytwentyone/package.json
@@ -17,15 +17,15 @@
 		"npm": ">=10.2.3"
 	},
 	"devDependencies": {
-		"@wordpress/browserslist-config": "^6.34.0",
+		"@wordpress/browserslist-config": "^6.45.0",
 		"@wordpress/eslint-plugin": "^22.20.0",
 		"@wordpress/stylelint-config": "^21.30.0",
-		"autoprefixer": "^10.4.22",
+		"autoprefixer": "^10.5.0",
 		"chokidar-cli": "^3.0.0",
 		"eslint": "^8.57.1",
 		"minimist": "^1.2.8",
 		"npm-run-all": "^4.1.5",
-		"postcss": "^8.5.6",
+		"postcss": "^8.5.14",
 		"postcss-calc": "^10.1.1",
 		"postcss-cli": "^11.0.1",
 		"postcss-css-variables": "^0.19.0",
@@ -36,7 +36,7 @@
 		"postcss-merge-rules": "^7.0.7",
 		"postcss-nested": "^7.0.2",
 		"rtlcss": "^4.3.0",
-		"sass": "^1.83.0",
+		"sass": "^1.99.0",
 		"stylelint": "^14.16.1",
 		"stylelint-config-recommended-scss": "^16.0.2"
 	},